T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:59
- Finding
- Execution of an Unpinned and Unaudited External Runner## Vulnerability Details **File Location**: `SKILL.md`, lines 59-78 **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium The Skill directs users to obtain a runner from an external GitHub or Gitee repository and subsequently execute it under the user's account. The external dependency is not pinned to an immutable commit or release, and no checksum or signature verification is specified. Relevant excerpt, rendered in English: ```markdown On first use, run the Skill's one-click installation script (check dependencies, clone the runner, verify the key, and test connectivity). Runner source: https://github.com/sensedeal/cue-skills Mirror: https://gitee.com/sensedeal/cue-skills python3 ~/.cue/cue-skills/cue-research/scripts/research_run.py \ --query "Monthly asset-allocation analysis" \ --template-id template_fkAFJt \ --output ~/cue-reports/$(date +%Y-%m)-asset-allocation.md ``` The package itself contains only `SKILL.md`. The referenced one-click installer and `research_run.py` are therefore outside the audited artifact. ### Technical Analysis The effective executable behavior is delegated to a mutable third-party repository. The documentation does not pin the runner to a specific commit hash, versioned release, or cryptographically verified artifact. Consequently, code installed at different times may differ from the code originally reviewed. The runner is executed directly with `python3` and inherits the invoking user's permissions, environment variables, filesystem access, and network access. The documented workflow also uses a Cue API credential stored in `~/.cue/config.json` or `CUE_API_KEY`, making that credential potentially accessible to the external runner. This is a supply-chain trust-boundary issue. It is not evidence that the current external repository is malicious, but the Skill provides no integrity control capable of detecting a future repository comprom ...[truncated 1790 chars]
- Remediation
- ## Remediation Suggestions 1. Bundle the installer and runner in the Skill package so their complete contents can be reviewed with the Skill. 2. If external distribution is necessary, pin the dependency to an immutable commit hash or signed release rather than a mutable branch. 3. Publish and verify a SHA-256 digest before executing any downloaded artifact. 4. Require cryptographic release signatures and document how users must verify the signer identity. 5. Ensure the GitHub and Gitee artifacts are generated from the same reviewed source and verify both against the same trusted digest. 6. Replace the empty installation block with an explicit, auditable installation procedure. Do not use a remote-script-to-shell pipeline. 7. Run the external component with restricted filesystem and network access, exposing only the report output directory and required Cue API endpoint. 8. Provide the Cue credential through a protected mechanism and prevent it from appearing in logs or process arguments. 9. Document the exact files, network destinations, and permissions required by the runner so users can enforce least privilege. 10. Add dependency provenance and integrity checks to updates, and fail closed when verification cannot be completed.